MAP · CONTROL · RECONCILE
Data-flow review: map copies before assessing risk
Follow actual fictional records through primary storage, a backup, an export and a restore.
Scroll the diagram left or right to inspect all three copies. The panels below give the same state as text.
Your experiment
Inspect which fields enter the export and where copies remain. Enable minimization, compare the exported keys, and record which additional legal and organizational questions this technical map cannot answer.
Play takes one minute at 1×. Pause, step or scrub the computed history. Input changes reset the experiment without autoplay. Red cards identify a previously deleted record that returned from backup.
Export snapshot
An export already copied to another destination is not automatically revoked by erasing the source.
Decision trace
Complete record and tombstone inventory
Technical teaching fixture, not legal advice, a GDPR/DPDP compliance assessment or an operational data-deletion service. All records and identities are fictional. The modeled policies are explicit choices, not statutory deadlines or legal bases. Verification and consent are switches, not identity checks or valid consent collection. Retention runs at days 9 and 20. Requested deletions schedule one backup purge; retention-expired backup copies remain visible and require a separate real-world policy. Tombstones block restoration; they are not anonymization. Holds are a fixture exception, not a legal determination. Real systems also need authorization roles, downstream deletion, backup lifecycle, notices, audit protection and jurisdiction-specific review. No personal information or external service is accessed. Official AICassindra learning resources.
Build technical evidence for a data-flow review
Record a2 is a fictional alpha-tenant prompt, initially fifteen days old. The fixture also contains profiles, a billing record and beta-tenant data, so request scoping can be inspected rather than assumed. Primary storage, backup and the exported snapshot are independent copies. Removing a prompt from primary storage does not erase an earlier export or a delayed backup. This data map supplies one technical input to a privacy impact review: which records exist, where copies persist and what a control changes. A complete DPIA also considers purposes, necessity, proportionality, risks to individuals and proposed safeguards. This simulator does not determine whether a DPIA is required or whether processing is lawful.
Choose the actor and request scope
Requested tenant selects alpha or beta; Actor tenant identifies the caller. Identity verified by the fixture must be enabled and those tenants must match before export or requested deletion is allowed. Requested subject selects s1 or s2. Request scope chooses that subject or the whole selected tenant; tenant scope also offboards the tenant after the requested deletion. Personalization purpose consent affects only the simulated purpose-use decision on day one. It does not grant cross-tenant access or prevent an otherwise authorized export. Minimize export fields removes tenant, subject and age metadata while retaining id, kind and the fictional value; it does not redact the value text itself.
Control retention and restoration
Retention window is compared with each record’s initial age plus the modeled day during the day-nine and day-twenty sweeps. Those sweeps are a system-wide background policy, separate from the actor’s scoped request. Backup purge after deletion schedules requested-deletion cleanup after day three; zero performs it on day three. Block restoration of deleted IDs controls whether restoring a backup may reintroduce previously erased IDs. Hold billing records against deletion keeps the billing fixture out of deletion and retention erasure. A tombstone records an erased identity even when restoration enforcement is disabled, allowing the later check to detect its resurrection.
Watch the default prompt disappear without erasing its export
Keep the default alpha/s1 subject request with a verified alpha actor and minimization disabled. At day two the export captures a1, a2 and the billing record a4. At day three, requested deletion removes a1 and a2 from primary storage while the held billing record remains. The export still contains its captured copies. Backup purge is delayed fourteen days, until day seventeen. At day ten, restore attempts to copy missing backup records into primary; enabled tombstones block the deleted prompt from returning. Select the exact inventory and audit records instead of assuming identical row counts mean identical storage state.
Reproduce resurrection and the purge boundary
Disable tombstone enforcement, disable the billing hold and set retention to ninety days so later age-based removal does not obscure the experiment. Keep backup delay fourteen. At day ten, the deleted alpha/s1 records return from backup and the day-eleven check reports the failure. Change delay to seven: purge occurs on day ten before restore under this fixture’s explicit same-day event order, so those requested-deletion records cannot be resurrected. Retention-expired backup records are not generally purged by this requested-deletion cleanup; that is a limitation, not a promise that all copies disappear.
Inspect snapshots and avoid broader guarantees
Play reveals the ordered event snapshots across sixty inspection seconds. Pause holds a snapshot; Next event advances; Restart rewinds; Speed changes inspection pace; Inspection time scrubs. Parameter edits rebuild the trace and pause it. Events are ordered by modeled day, not uniformly spaced real days. The source records, export, tombstones and audit entries are fictional, and no database or cloud service is contacted. There is no encryption, real secret detection, legal retention determination, export recall or propagation across arbitrary storage systems. Subject deletion does not ban future collection: the active tenant can receive a new record on day twelve. Tenant offboarding blocks that late write in this model.
Record residual questions alongside the trace
Compare the export before and after minimization: metadata fields disappear but the fictional value remains. That can reduce one exposure without anonymizing the content. An exported snapshot remains outside later source deletion. Document those residual copies in the notebook rather than assigning an invented compliance score. A real assessment needs accountable owners, processing context, affected people, recipient access, jurisdiction-specific review and evidence that proposed controls operate in the deployed system. Capture baseline, Replace baseline and Clear baseline help compare the inspected scenarios. Export notes saves your observations; Expand experiment provides a larger view. Open the record inventory for text alternatives to the diagram, and use its horizontal scroll region to inspect every column on a phone.